Date: Sun, 24 Jul 2011 03:34:38 +0000 (UTC) From: Glen Barber <gjb@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r224286 - head/usr.sbin/jail Message-ID: <201107240334.p6O3YcTh088756@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gjb (doc committer) Date: Sun Jul 24 03:34:38 2011 New Revision: 224286 URL: http://svn.freebsd.org/changeset/base/224286 Log: Document the potential for jail escape. Submitted by: Vedad KAJTAZ (vedad % kajtaz net) PR: 142341 Reviewed by: bz, rwatson Rewording by: rwatson Approved by: re (kensmith) MFC after: 3 days Modified: head/usr.sbin/jail/jail.8 Modified: head/usr.sbin/jail/jail.8 ============================================================================== --- head/usr.sbin/jail/jail.8 Sun Jul 24 01:36:01 2011 (r224285) +++ head/usr.sbin/jail/jail.8 Sun Jul 24 03:34:38 2011 (r224286) @@ -34,7 +34,7 @@ .\" .\" $FreeBSD$ .\" -.Dd January 17, 2010 +.Dd July 23, 2011 .Dt JAIL 8 .Os .Sh NAME @@ -907,3 +907,10 @@ Currently, the simplest answer is to min offered on the host, possibly limiting it to services offered from .Xr inetd 8 which is easily configurable. +.Sh NOTES +Great care should be taken when managing directories visible within the jail. +For example, if a jailed process has its current working directory set to a +directory that is moved out of the jail's chroot, then the process may gain +access to the file space outside of the jail. +It is recommended that directories always be copied, rather than moved, out +of a jail.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201107240334.p6O3YcTh088756>